Enabling NSG Flow Logs and Traffic Analytics for Network Monitoring
You need to monitor and log network traffic between Azure VMs for security analysis. Which THREE components should you enable?
Quick Answer
The correct answer is to enable NSG flow logs, Traffic Analytics, and Azure Monitor Logs. NSG flow logs capture IP traffic data between Azure VMs, providing raw records of all allowed and denied flows, while Traffic Analytics processes this data to deliver visual insights into traffic patterns, top talkers, and anomalies for security analysis. Azure Monitor Logs then stores and queries these enriched logs, enabling deep forensic investigation. On the AZ-500 exam, this scenario tests your understanding of the layered monitoring pipeline: raw capture (NSG flow logs), intelligent analysis (Traffic Analytics), and centralized storage/querying (Azure Monitor Logs). A common trap is confusing Azure Firewall logs, which only track firewall-filtered traffic, with VM-to-VM flow logging, or assuming VNet flow logs exist as a separate feature. Remember the memory tip: “Capture, Analyze, Store” — NSG flow logs capture, Traffic Analytics analyzes, and Log Analytics stores.
⚠ Common exam trap
A common mix-up: candidates confuse Azure Firewall logs (which only log traffic passing through the firewall) with NSG flow logs (which log all traffic allowed or denied by a Network Security Group), and mistakenly think 'VNet flow logs' is a real Azure feature when it does not exist.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Monitor Logs (Log Analytics workspace)
Azure Monitor Logs (Log Analytics workspace) is correct because it serves as the central ingestion and storage destination for network monitoring data. NSG flow logs capture IP traffic through Network Security Groups, and Traffic Analytics processes those raw flow logs to provide visualizations, top-talkers, and anomaly detection. Together, these three components enable comprehensive network traffic monitoring and security analysis for Azure VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Monitor Logs (Log Analytics workspace)
Why this is correct
Flow logs are sent to Log Analytics for querying.
- ✗
Azure Firewall logs
Why it's wrong here
Firewall logs only capture traffic passing through the firewall.
- ✓
NSG flow logs
Why this is correct
NSG flow logs record IP traffic through NSGs.
- ✓
Traffic Analytics
Why this is correct
Traffic Analytics processes NSG flow logs to provide intelligence.
- ✗
VNet flow logs
Why it's wrong here
There is no such feature; NSG flow logs are used.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team needs to analyze network traffic to and from Azure virtual machines to investigate a potential security incident. They want to capture information such as source IP, destination IP, port, and protocol. Which Azure service should they enable on the network security groups (NSGs) associated with the virtual machine subnets?
easy- ✓ A.Network Watcher NSG flow logs
- B.Azure Monitor logs
- C.Traffic Analytics
- D.Azure Firewall logs
Why A: Network Watcher NSG flow logs capture IP traffic flowing through Network Security Groups, recording source IP, destination IP, port, and protocol for each flow. This directly meets the requirement to analyze network traffic to and from Azure VMs for security incident investigation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.